Hardware hacking Security vulnerabilities in microcontrollers detected

Related Vendor

Wuxi InfiMotion Technology Co., Ltd.

Microcontrollers are the heart of numerous connected systems. Although they store sensitive data, the security of the underlying hardware is scarcely considered during product development – leaving them vulnerable to hacker attacks.

Simple measures are already sufficient to prevent cyberattacks. This is shown by the study on hardware attacks on microcontrollers by the Fraunhofer Institute for Applied and Integrated Security AISEC, commissioned by the Federal Office for Information Security (BSI).

Microcontrollers are indispensable for the Internet of Things (IoT). These small single-chip computer systems are used in nearly all smart devices – from industrial and consumer products to sensitive applications such as access control systems, e-Wallets, and critical infrastructures in aviation or medicine. Microcontrollers store sensitive data such as cryptographic keys, access data, and valuable intellectual property. However, due to cost reasons and a lack of awareness of the dangers, standard microcontrollers are often used in security-relevant IoT products, making them an attractive target for attackers who also exploit vulnerabilities in the hardware.

Protection measures for relevant attack techniques tested

The study "Hardware Attacks against Microcontrollers", conducted by Fraunhofer AISEC on behalf of the BSI, shows that hardware protection receives too little consideration in product development. Many smart devices, whose core are microcontrollers, have security vulnerabilities. However, even in IoT devices that are already in circulation, protection measures can easily be implemented via software to prevent most relevant hardware attacks or significantly increase the effort required by an attacker. To raise awareness of the dangers in development and manufacturing, the researchers at Fraunhofer AISEC have evaluated three types of hardware attacks on microcontrollers and proposed appropriate countermeasures:

Hardware attacks and countermeasures

1) Control-Flow Attacks (control flow manipulation): In this attack technique, the proper execution of a program is manipulated through voltage and clock glitching, electromagnetic, or laser-based error injection. Attacks of this kind can be prevented or at least made more cumbersome through compiler-based countermeasures based on existing error detection systems. Software tools of this kind are currently a subject of research in hardware security. Initial versions of the tools are already being used in the industry.

2) Side-Channel Attacks: Insights into the energy consumption and electromagnetic emission of the chip allow attackers unauthorized knowledge about keys in the microcontroller. To prevent these sensitive pieces of information from being spied on, so-called leakage-resilient cryptographic methods, or the masking of secret values, or shuffling of the processing sequence can act as protective measures. This obscures correlations between measured values and sensitive information.

3) Attacks on Read-Out Protection Techniques: Vulnerabilities in the debug interface can be exploited to access confidential data on the microcontroller. While bypassing the read-out protection mechanism cannot be entirely prevented through software-based methods alone, the impact of an attack can be significantly reduced depending on the product, for example by using code obfuscation techniques or by encrypting sensitive data stored in the flash memory area.

The three examined attack techniques endanger the integrity, confidentiality, and reliability of almost all microcontrollers identified in a market analysis and the information stored on them. The countermeasures proposed and practically demonstrated in the study can be software-based and often implemented retrospectively, without significantly impairing the performance or function of the controller.

Appeal to industry, research, and policy

However, these protective measures are not yet widely applied. The researchers therefore urge microcontroller manufacturers to include hardware attacks in their threat models and to disclose these models. This information would enable IoT product manufacturers, who integrate their microcontrollers, to select appropriate products for security-relevant applications.

They call on the research community to improve the tools for software-based countermeasures in terms of practicability and user-friendliness for embedded developers. They urge legislators and regulators to create economic incentives so that protective measures against hardware attacks become essential for certain applications. Ultimately, consumers can also have a significant impact on the progress in developing better-protected hardware through their purchasing behavior.

The research team of the "Hardware Security" department at Fraunhofer AISEC emphasizes: "Our study shows that hardware attacks on microcontrollers represent a real threat to security-relevant IoT systems. We want to encourage always considering the security of microcontrollers during their development and implementing effective countermeasures." (mk)